Why is this an issue?

A CPU limitation for a container is a specified boundary or restriction that determines the maximum amount of CPU resources that a container can utilize. It is a part of resource management in a containerized environment, and it is set to ensure that a single container does not monopolize the CPU resources of the host machine.

CPU limitations are important for maintaining a balanced and efficient system. They help in distributing resources fairly among different containers, ensuring that no single container can cause a system-wide slowdown by consuming more than its fair share of CPU resources.

What is the potential impact?

Performance degradation

Without CPU limitations, a single container could monopolize all available CPU resources, leading to a system-wide slowdown. Other containers or processes on the same host might be deprived of the necessary CPU resources, causing them to function inefficiently.

System instability

In extreme cases, a container with no CPU limit could cause the host machine to become unresponsive. This can lead to system downtime and potential loss of data, disrupting critical operations and impacting system reliability.

How to fix it

Code examples

Noncompliant code example

apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
    - name: web # Noncompliant
      image: nginx

Compliant solution

apiVersion: v1
kind: Pod
metadata:
  name: example
spec:
  containers:
    - name: web
      image: nginx
      resources:
        limits:
          cpu: 0.5

How does this work?

A limit can be set through the property resources.limits.cpu of a container. Alternatively, a default limit for a namespace can be set with LimitRange.